Drop-in replacement for Python's CSV library that tries to mitigate CSV injection attacks
.. image:: https://img.shields.io/pypi/v/defusedcsv.svg :target: https://pypi.python.org/pypi/defusedcsv
.. image:: https://travis-ci.org/raphaelm/defusedcsv.svg?branch=master :target: https://travis-ci.org/raphaelm/defusedcsv
.. image:: https://codecov.io/gh/raphaelm/defusedcsv/branch/master/graph/badge.svg :target: https://codecov.io/gh/raphaelm/defusedcsv
If your Python application offers CSV export of user-generated data, that user-generated data might contain malicious payloads that might trigger vulnerabilities in the spreadsheet software of the user that downloads the file (i.e. MS Excel or LibreOffice).
This library tries to mitigate that by prepending all cells starting with @, +,
-, =, | or % with an apostrophe ' and additionally replacing all
| characters in these cells with \|. This will of course change the resulting
CSV files, but Excel will not display the ' character to the user.
Tested with Python 3.8 to 3.10.
This library acts as a drop-in replacement for the standard library's csv module. You can use it by just replacing
import csv with from defusedcsv import csv in your code.
CSV Injection Software Attack | OWASP Foundation <https://owasp.org/www-community/attacks/CSV_Injection>_Comma Separated Vulnerabilities | Context Information Security <https://www.contextis.com/resources/blog/comma-separated-vulnerabilities/>_CSV Injection Mitigations & Dangers | ZeroSec - Adventures In Information Security <https://blog.zsec.uk/csv-dangers-mitigations/>_The code in this repository is published under the terms of the Apache License. See the LICENSE file for the complete license text.
This project is maintained by Raphael Michel mail@raphaelmichel.de. See the AUTHORS file for a list of all the awesome folks who contributed to this project.
FAQs
Drop-in replacement for Python's CSV library that tries to mitigate CSV injection attacks
We found that defusedcsv demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
PyPI confirms no security flaws were exploited in the Ultralytics supply chain attack and highlights improvements for safer package publishing.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.